Verified Agent Skill record

Report Writing

A report-writing skill for bug bounty submissions to HackerOne, Bugcrowd, Intigriti, and Immunefi. It provides platform-specific report templates, impact-first and human-tone guidance, title and impact formulas, CVSS 3.1 and CVSS 4.0 references, severity guidance, downgrade counters, reproduction formats, and a pre-submit checklist.

Tasks

Draft a bug bounty report using the relevant HackerOne, Bugcrowd, Intigriti, or Immunefi structure, including the affected endpoint or feature, attacker access level, reproduction steps, observed response, impact, and remediation.
Create a specific, impact-first title using the documented bug-class, endpoint or feature, attacker role, impact, and victim-scope pattern.
Assign and explain a CVSS 3.1 score when required, or use the documented CVSS 4.0 fields and vector format when the program uses CVSS 4.0.
Rewrite findings in direct human language that states demonstrated effects without theoretical or qualifying claims.

Inputs

A validated security finding and its demonstrated reproduction details.
The target platform or report format, when applicable.
Observed requests, responses, affected data, access requirements, and impact measurements, when available.

Outputs

A structured bug bounty report.
A specific impact-first report title.
Reproduction steps with exact request and response details when available.
A severity justification and CVSS score or vector when supported by the documented facts.
A concise recommended fix.

Limitations and checks

The skill covers written report content, templates, tone, formulas, severity guidance, and pre-submit checks; validation and submittability decisions belong to another skill.
The documented examples and guidance do not establish that every platform accepts every listed format or severity convention.
Do not claim impact that has not been demonstrated.
Installation instructions and installation commands are undocumented.
Confirm that the title identifies the bug class, endpoint or feature, attacker role, and impact rather than using a vague vulnerability label.
Confirm that the first sentence states the demonstrated impact in plain English.
Confirm that reproduction steps include an exact HTTP request and the response showing the issue when applicable.
Confirm that authorization findings use separate attacker and victim accounts rather than testing only one account.